System and method for improved in-browser notification

ABSTRACT

Systems and methods for sending/receiving improved in-browser notification messages are provided. The notification messages are overlaid on HTTP traffic on port 80 for IP addresses provisioned to receive the notification messages from various sources, including weather, emergency broadcast, and police stations. A load balancer within the end-to-end system allows HTTP traffic on port 80 to be forked from non HTTP traffic on port 80 to selectively insert notification messages. The notifications are inserted by an internet content adoption protocol (ICAP) server in communication with other devices within the system.

TECHNICAL FIELD

Aspects of the disclosure relate to providing notifications tosubscribers via an internet browser. More specifically, aspects of thedisclosure relate to methods and related systems for sending in-browsermessages to subscribers in real-time.

BACKGROUND

It is necessary for an internet service provider (ISP) to inform itssubscribers in real-time about important information pertaining tousage, policy changes, alerts, etc. ISPs currently utilize severalmethods, including e-mail, telephone, postal mail, and walled-garden andproprietary vendor in-browser notification products, to notifysubscribers. However, these notification methods are not immediate andnot always successful. For instance, subscribers do not regularly checktheir emails and, therefore, may overlook the urgency of a particularmessage. Also, postal mail should not be utilized for extremelytime-sensitive messages that require immediate attention. In addition,subscribers may not appreciate unsolicited telephone calls from theirISP.

While a walled-garden approach to notifying subscribers may be effectivefor certain applications, the drawback to this method is that it blocksall network traffic and, therefore, the user is unable to browse theinternet while receiving notifications. As such, the need arises for areal-time notification method that is guaranteed to be viewed and doesnot disrupt subscriber services.

Currently, there are certain methods for performing in-browsernotifications, all of which have limitations. One method is to deploy asystem that inspects all packets traversing through the ISP's networkand inject extra packets into the stream to notify the user when needed.The technology underlying this method is commonly referred to as DeepPacket Inspection and may serve many other purposes but requires thatthe technology be deployed throughout the ISP's network in order to viewall packets. This technique is not passive and requires connections tobe reset. The system has to spoof the server response to an HTTP requestpacket in order to insert a notification. Therefore, the perception ofauthenticity from the subscriber's point-of-view may be reduced.

A second current method for performing in-browser notifications is tohave a software application deployed on the subscribers' computer thatautomatically displays a notification when needed. However, this methodis inefficient as it requires the user to install the ISP's softwarepackage on each PC for the notification to be read.

Therefore, there is a need in the art for alternative schemes forrouting specific traffic to users that need to be notified with amessage in real-time over the internet.

BRIEF SUMMARY

The following presents a simplified summary of the disclosure in orderto provide a basic understanding of some aspects. It is not intended toidentify key or critical elements or to delineate the scope of thedisclosure. The following summary merely presents some concepts of thedisclosure in a simplified form as a prelude to the more detaileddescription provided below.

In an illustrative aspect of the disclosure, a notification system andmethod provides for implementation of in-browser messaging for thecommunication of information between an ISP and a subscriber.

In another illustrative aspect of the disclosure, the in-browsernotification method allows an ISP provider to provide weather updates,emergency broadcasts, and other messages to subscribers that need suchnotification.

Other embodiments may be partially or wholly implemented on acomputer-readable medium, for example, by storing computer-executableinstructions or modules, or by utilizing computer-readable datastructures.

Of course, the methods and systems of the above-referenced embodimentsmay also include other additional elements, steps, computer-executableinstructions, or computer-readable data structures. In this regard,other illustrative embodiments are disclosed and claimed herein as well.

The details of these and other embodiments are set forth in theaccompanying drawings and the description below. Other features andadvantages will be apparent from the description and drawings, and fromthe claims.

BRIEF DESCRIPTION OF THE DRAWINGS

A more complete understanding of aspects of the present disclosure andthe advantages thereof may be acquired by referring to the followingdescription in consideration of the accompanying drawings, in which likereference numbers indicate like features, and wherein:

FIG. 1 illustrates a schematic diagram of a general-purpose digitalcomputing environment in which certain aspects of the disclosure may beimplemented.

FIG. 2 illustrates an in-browser notification system in accordance withvarious aspects of the disclosure.

FIG. 3 illustrates a flow chart for setting a policy to tag HTTP packetswith a DSCP value in accordance with various aspects of the disclosure.

FIG. 4 a illustrates a flow chart for marking appropriate data packetsfor an in-browser notification system in accordance with various aspectsof the disclosure.

FIG. 4 b illustrates a flow chart for inserting a notification intoappropriate data packets for an in-browser notification system inaccordance with various aspects of the disclosure.

DETAILED DESCRIPTION

In the following description of the various embodiments, reference ismade to the accompanying drawings, which form a part hereof, and inwhich is shown by way of illustration, various embodiments in which thedisclosure may be practiced. It is to be understood that otherembodiments may be utilized and structural and functional modificationsmay be made.

FIG. 1 illustrates a block diagram of a generic computing device 101(e.g., a computer server) in network 100 that may be used according toan illustrative embodiment of the disclosure. The computer server 101may have a processor 103 for controlling overall operation of the serverand its associated components, including RAM 105, ROM 107, input/outputmodule 109, and memory 115.

I/O module 109 may include a microphone, keypad, touch screen, and/orstylus through which a user of device 101 may provide input, and mayalso include one or more of a speaker for providing audio output and avideo display device for providing textual, audiovisual and/or graphicaloutput. Software may be stored within memory 115 and/or storage toprovide instructions to processor 103 for enabling server 101 to performvarious functions. For example, memory 115 may store software used bythe server 101, such as an operating system 117, application programs119, and an associated database 121. Alternatively, some or all ofserver 101 computer executable instructions may be embodied in hardwareor firmware (not shown).

The server 101 may operate in a networked environment supportingconnections to one or more remote computers, such as terminals 141 and151. The terminals 141 and 151 may be personal computers or servers thatinclude many or all of the elements described above relative to theserver 101. The network connections depicted in FIG. 1 include a localarea network (LAN) 125 and a wide area network (WAN) 129, but may alsoinclude other networks. When used in a LAN networking environment, thecomputer 101 is connected to the LAN 125 through a network interface oradapter 123. When used in a WAN networking environment, the server 101may include a modem 127 or other means for establishing communicationsover the WAN 129, such as the internet 131. It will be appreciated thatthe network connections shown are illustrative and other means ofestablishing a communications link between the computers may be used.The existence of any of various well-known protocols such as TCP/IP,Ethernet, FTP, HTTP and the like is presumed.

Computing device 101 and/or terminals 141 or 151 may also be mobileterminals including various other components, such as a battery,speaker, and antennas (not shown).

The disclosure is operational with numerous other general purpose orspecial purpose computing system environments or configurations.Examples of well known computing systems, environments, and/orconfigurations that may be suitable for use with the disclosure include,but are not limited to, personal computers, server computers, hand-heldor laptop devices, multiprocessor systems, microprocessor-based systems,set top boxes, programmable consumer electronics, network PCs,minicomputers, mainframe computers, distributed computing environmentsthat include any of the above systems or devices, and the like.

The disclosure may be described in the general context ofcomputer-executable instructions, such as program modules, beingexecuted by a computer. Generally, program modules include routines,programs, objects, components, data structures, etc. that performparticular tasks or implement particular abstract data types. Thedisclosure may also be practiced in distributed computing environmentswhere tasks are performed by remote processing devices that are linkedthrough a communications network. In a distributed computingenvironment, program modules may be located in both local and remotecomputer storage media including memory storage devices.

FIG. 2 illustrates a high level diagram of a system 200 that may be usedto provide in-browser notifications in real-time in accordance with anillustrative embodiment of the disclosure.

As illustrated, system 200 depicts a notification platform (NP) 202, anapplication manager 204, a policy server 206, a PC 208, a cable modem210, a cable modem termination system (CMTS) 212, routers 214 and 218, aload balancer 220, an internet server 222, a proxy server 224, and aninternet content adoption protocol (ICAP) server 226. The components ofsystem 200 may be connected by one or more communications links (asdesignated by the arrows in FIG. 2) to a single or multiple networks.

The NP 202 may receive and process a request from an external system tonotify a subscriber of an in-browser notification in accordance with anaspect of the disclosure. The NP 202 may also identify subscriberdetails, determine which notification template to invoke, and maymaintain state information on whether a subscriber has acknowledged anin-browser notification. In addition, the application manager 204 andpolicy server 206 may be utilized to establish a service flow, such asin accordance with the PacketCable Multi-Media specification, betweenthe subscriber's cable modem 210 and CMTS 212. The CMTS 212 may maintaina service-flow to the cable modem 210 and add a Differentiated ServicesCode Point (DSCP) marking for TCP port 80 traffic. It should be notedthat a DSCP marking may be set on a router directly for a given IPaddress and as such the application manager 204, policy server 206,cable modem 210 and CMTS 212 may be less pertinent.

Routers 214 and 218 may be utilized in system 200 to policy routetraffic over a Generic Routing Encapsulated (GRE) tunnel 216. As packetstraverse through the router 214, they may be forked based on a routingpolicy. DSCP-tagged packets may be sent over the GRE tunnel 216 whileall other packets may be normally forwarded to internet server 222.Another router 218 may be used as a GRE-end point and a default routingpolicy may be set to forward all packets to the load balancer 220. Theload balancer 220 may be responsible for forking HTTP traffic on port 80to a proxy server 224 and all other port 80 traffic back to the Internetserver 222. The load balancer 220 may also send a “HTTP 305 Use Proxy”response back to the PC 208 for any HTTP requests. The use proxyresponse may contain the location in URL format of the proxy server 224.The PC 208 may then directly contact the proxy server 224 to access webcontent.

The proxy server 224 may maintain state information on the sessionbetween the subscriber's internet browsing session and the internet. Aspackets traverse through the proxy 224, it may query the ICAP server 226to determine whether the request may be fit for notification insertion.The ICAP server 226 may respond with a confirmation and once an HTTP 200OK response is received, the proxy server 224 may forward the packets tothe ICAP server 226 for notification insertion. The ICAP server 226 maycontact the NP 202 to retrieve the notification(s) that needs to beinserted. The ICAP Server 226 may also cache the notification internallyor externally for the purpose of improving response times.

The steps that follow in FIGS. 3, 4 a, and 4 b may be implemented by oneor more of the components in FIGS. 1, 2, and/or other components,including other computing devices.

FIG. 3 illustrates a flow chart depicting a method for setting a policyon the CMTS to tag HTTP packets with a DSCP value in accordance withvarious aspects of the disclosure. The process begins at step 301 whenNP 202 associated with an entity may receive IP addresses of subscribersthat need to be notified. The entity may include any IP service providerhaving a plurality of users supported by these services. The NP 202 mayreceive this information from a variety of sources, including a businesspolicy engine also associated with the entity and/or other sourcesdirectly from a third party. The ultimate source of third partyinformation may be weather stations, police stations, hospitals, and/oran emergency broadcast station, among other places. The content of thenotification may determine the ultimate source; for instance, weatherstations may issue hurricane/tornado alerts for a particular communityin a particular area and police stations may issue alerts for escapedcriminals or amber alerts for missing children. In addition, the IPservice provider may issue a notification to provide subscriberinformation about service outages, security threats, service alerts,and/or byte usage.

Then the process may move to step 303 where the NP may transmit the IPaddress information to an application manager 204 and/or policy server206. The application manager 204 and policy server 206 may transmitinformation for setting a policy on the CMTS 212 to tag all TCP port 80data packets coming from a subscriber's PC 208 and/or cable modem 210with a DSCP value in step 305. This DSCP value may indicate that the IPaddresses that have transmitted the corresponding data packets may needto be notified with a message. It should be noted that even though TCPport 80 data packets are tagged with a DSCP value in an exemplaryembodiment, the tagging of packets on other ports outside of port 80using other indicators outside of DSCP values is within the scope of thepresent disclosure. Even though application manager 204 and policyserver 206 are shown as two different hardware components, in otherembodiments, both of these components may be incorporated into a singlepiece of hardware. The same is true of the cable modem 210 and PC 208;although FIG. 2 shows the cable modem 210 and PC 208 as two differententities, both of these components may be integrated in a single devicewith integrated functionality.

FIG. 4 a shows a flow chart depicting a method for marking appropriatedata packets in an improved in-browser notification system in accordancewith various aspects of the disclosure. The process in FIG. 4 a maystart at step 401 a where data packets may be received by the CMTS 212from a subscriber device such as cable modem 210 and/or PC 208. Thesedata packets may include messages related to an HTTP GET request foraccessing a particular webpage among other types of content. The processmay then move to decision step 403 a where the CMTS 212 may decide ifthe port 80 packets received from the subscriber should be marked with aDSCP value for receiving a notification message. If not, then thepackets may be routed normally without being marked to default next hopas illustrated in 407 a. If the port 80 packets do need to be markedwith the appropriate DSCP value, the packets may be marked by the CMTS212 in step 405 a.

The process then moves to step 409 a where packets may arrive at router214. Then in step 411 a, the router 214 may check whether data packetsare marked with a specific DSCP value. If yes, as noted in 413 a, thendata packets are routed to a GRE endpoint through routers 214 and 218using tunnel 216 as noted in 417 a and 419 a. If no, the data packetsare routed to the default next hop in step 415 a. In certainembodiments, multiple routers may not need to be used and only a singlerouter routes the packets within system 200. Next, in step 421 a, thedata packets may be transmitted to a load balancer 220. After arrivingat the load balancer 220, the process may then move to step 423 a wherea decision is made by the load balancer 220 as to whether the datapackets may be categorized as either HTTP or non-HTTP traffic on TCPport 80 as illustrated in step 425 a. If the packets are not both port80 and HTTP, the packets may be routed to the internet server 222 instep 427 a. This routing mechanism may occur by transmitting the datapackets back to router 218 for transmitting to the internet server 222.

If the packets are both port 80 and HTTP traffic, the process then maymove to step 429 a where they may be sent to a proxy 224. The proxyserver 224 may route the packets to the appropriate internet server 222in step 431 a. It should be noted that even though the load balancer 220and proxy 224 are shown as two separate entities, a single componentthat combines the functionalities of both entities may also be used. Itshould also be noted that the load balancer 220 functionality may alsobe served by alternate means. For example, this functionality may occurvia a server capable of identifying HTTP traffic and non-HTTP traffic onTCP port 80, capable of preserving existing TCP sessions and relayingHTTP traffic from the PC 208 to the proxy 224.

FIG. 4 b shows a flow chart depicting a method for inserting anotification in an improved in-browser notification system in accordancewith various aspects of the disclosure. After the packets reach theinternet server 222 after being relayed by the proxy 224 as noted in 401b, response data packets responsive to incoming data packets may arriveat the proxy server 224 in step 403 b. The process may then move to step405 b where the proxy 224 sends a request for content adaption withpreview data packets from the response to the ICAP server 226. Thepreview contains partial content from the HTTP response. Then in steps407 b and 409 b the ICAP server 226 may determine whether a notificationmessage can be inserted based on the preview. If no, as noted in step411 b, the ICAP server 226 may respond with a message instructing thatproxy 224 that no modifications are needed. The process may then jump tostep 431 b where the proxy 224 may forward response packets to the PC208 and/or cable modem 210 without inserting a notification message.

If the ICAP server 226 determines that content is fit for adaption, asnoted in step 413 b, then the ICAP server 226 may return 100 OK messageto the proxy 224. The 100 OK message instructs the proxy 224 that anotification message may be inserted in the response. In step 415 b, theproxy 224 may send all the packets in the HTTP response to the ICAPserver 226. Then in step 417 b and step 419 b, the ICAP server 226 maycheck whether any notification messages for the IP address are cachedlocally. If no, then the ICAP server 226 may attempt to fetch thenotification message from the NP 202 as noted in step 421 b and cachethe notification locally for content adaption on subsequent requestsfrom the PC 208. Then the process moves to step 423 b where the systemmay check to see if a message is present for the subscriber IP. If nomessage is present for the subscriber IP, as noted in step 425 b, then anotification message may not be inserted and the process may jump tostep 431 b where the proxy 224 may forward the response data packets tothe PC 208. If a notification message is present for the IP address,then the ICAP server 226 may parse the HTTP content and insert thenotification message in the response data packets as noted in step 427b. The message insertion is done in a manner that does not alter theoriginal content of the response. After insertion is complete, the ICAPserver 226 may reassemble the content before forwarding the responsepackets back to the proxy server 224 as noted in step 429 b.

Finally, the data packets may be routed to back to the PC 208 and/orcable modem 210 in step 431 b and the browser on the PC 208 may renderthe HTML content plus the notification, if inserted earlier, as anoverlay in step 433 b.

As an example consider, the case of a weather station (assume WCHI)trying to issue a tornado warning for the metro Chicago area.

Once the tornado is detected, WCHI may notify the Internet ServiceProvider (assume it is Comcast) of a tornado alert in the metro Chicagoarea. Upon receipt of this information, the ISP may initiate anotification message through one of its internal servers. Thisnotification may state that Chicago residents should take necessaryprecautions against the impending tornado. The internal server may beany storage device capable of communication through a network with otherdevices in the IP network, including a business policy engine or a NP.Alternatively, a business policy engine and NP may both play a part inprovisioning the proper IP addresses for receiving the notification of atornado approaching.

Once the internal server has properly provisioned the appropriate IPaddresses for a notification, the server may then communicate with anapplication manager. The application manager may set a policy on theCMTS associated with the IP service provider for marking traffic on TCPport 80 with a DSCP value of 8 in the header of the data packets fromthe IP addresses in question. Assume that a DSCP value of 8 indicatesthat the data packets associated with that IP address are port 80traffic. It should be noted that HTTP traffic on other ports may also bemarked in other embodiments of the disclosure.

Several minutes after the policy has been set, assume that a subscriberassociated with one of the IP addresses in the metro Chicago area maydecide to browse the Internet for the day's latest news fromExample.com. Assume that the subscriber wishes to accesshttp://www.example.com for news information. When she types in thisaddress into her web browser, an HTTP GET request is sent from thesubscriber's PC, which traverse through the CMTS. Note that in certainembodiments the data packets may be sent from the subscriber's PC to hercable modem, which may be responsible for forwarding the data packets tothe CMTS. It should also be noted that at any time after the policymarking port 80 traffic has been set, web activity by the subscriber maytrigger the notification process described here (i.e., subscriber doesnot have to wait several minutes after the policy has been set for thisprocess to work).

Upon arrival of the data packets including the HTTP GET request, theCMTS may realize that the port 80 traffic from the subscribers' IPaddresses needs to be marked with a DSCP value, for example 8, toindicate that this IP address should receive a notification about thetornado. As a result, the CMTS may mark the TCP port 80 traffic from thedata packets associated with the subscriber and transmit the packetupstream to another router. A policy based route may be defined on therouter that would then route all traffic with a DSCP 8 marking to an endpoint such as a router. The router then forwards all packets to a loadbalancer. It should be noted that data packets from other IP addressesrequesting http://www.example.com may be transmitted straight to theinternet server for Example.com via a router. In fact, data packets fromother IP addresses not provisioned for receiving the tornado warningmessage and requesting any other internet server content may movestraight to that server since these IP addresses may not need to receivea tornado warning.

Once the data packets associated with the IP address in question reachthe load balancer, they may be forked into two different directions. Thedata packets that are HTTP traffic on TCP port 80 may be forwarded to aproxy server, which then forwards them to the Example.com server. Allother non-HTTP traffic on TCP port 80 may be routed to the destinationserver using other routers in the system. Once the data packets reachthe Example.com server, assume that the server has no objections to thesubscriber accessing its website and hence decides to send a HTTP 200 OKresponse code along with the message body and any other response datapackets. The response data packets may be forwarded back to the proxyserver. The proxy server may then determine that the response datapackets contain HTTP traffic on port 80 and are provisioned for an IPaddress that should receive a notification; hence the proxy server maycontact the ICAP server about the notification message that should beinserted into the response data packets.

The ICAP server may parse the response data packets associated with theIP address in question, insert the notification as an overlay into thesepackets, reassemble them after insertion of the notification, andfinally forward the response data packets back to the proxy server afterreassembly. The notification message may read “Comcast has received atornado warning from WCHI for the metro Chicago area from 5:30 pm to5:57 pm. Please take all necessary precautions.” In inserting the propernotification message, the ICAP server may or may not contact an internalserver such as the NP to generate a message template. It should be notedthat in inserting the notification into the response data packets, theICAP server may not tamper with the response data itself; thenotification message may be overlaid with minimal change to the responsedata content.

The proxy server may then forward the response data packets deliveringthe website http://www.example.com along with the notification statedabove to the subscriber's web browser. The notification may be placed atany position on the webpage.

The notification may allow the subscriber to get rid of it byacknowledging that she has read it (i.e., clicking on a dialog box in awindow containing the notification). In this way the notification mayallow the subscriber to continue with reading the news onhttp://www.example.com and minimize the amount of disruption to heractivity on the internet. The user may also choose to “snooze” thereminder whereby which the notification is disabled temporarily and theuser is notified at a later time.

While illustrative systems and methods as described herein embodyingvarious aspects of the present disclosure are shown, it will beunderstood by those skilled in the art, that the disclosure is notlimited to these embodiments. Modifications may be made by those skilledin the art, particularly in light of the foregoing teachings. Forexample, each of the elements of the aforementioned embodiments may beutilized alone or in combination or subcombination with elements of theother embodiments. It will also be appreciated and understood thatmodifications may be made without departing from the true spirit andscope of the present disclosure. The description is thus to be regardedas illustrative instead of restrictive on the present disclosure.

1. A method comprising: receiving IP address information including aplurality of IP addresses to set a policy to mark traffic with anindicator wherein the indicator indicates that an IP address needs toreceive a notification, wherein the IP address information andnotification originates at one of a weather station, police station, andemergency transmission service; receiving a first set of data packetsfrom a user device; determining if the first set of data packets istransmitted from an IP address that matches one of the plurality of IPaddresses included in the IP address information; if no match,transmitting the first set of data packets to an internet server via arouter; and if matched: marking the first set of data packets with theindicator; and transmitting the first set of data packets via a routerto a load balancer.
 2. The method of claim 1 wherein the indicator is aDifferentiated Services Code Point (DSCP) value.
 3. The method of claim1 wherein only port 80 traffic is marked with the indicator.
 4. A methodcomprising: receiving a first set of data packets marked with anindicator that indicates that an IP address associated with a source ofthe data packets should receive a notification; if the first set of datapackets is HTTP traffic, transmitting the first set of data packetsstraight to an internet server; if the first set of data packets is notHTTP traffic, transmitting the first set of data packets to the internetserver via an alternate route; receiving a second set of data packetsresponsive to the first set of data packets from the internet server;contacting an Internet Content Adoption Protocol (ICAP) server forinsertion of the notification into the second set of data packets whenthe second set of data packets is HTTP traffic destined for an IPaddress provisioned for receiving the notification, wherein the InternetContent Adoption Protocol (ICAP) server parses the second set of datapackets; transmitting the second set of data packets to a user devicewherein a browser on the user device displays the second set of datapackets with the notification on a webpage.
 5. The method of claim 4further comprising removing all of the markings in the first set of datapackets after receiving them.
 6. The method of claim 4 wherein the firstset of data packets is received from a cable modem termination system(CMTS) via a router.
 7. The method of claim 4 wherein the indicator is aDifferentiated Services Code Point (DSCP) value.
 8. The method of claim4 wherein only port 80 traffic is marked.
 9. The method of claim 4further comprising preserving other existing TCP sessions while routingthe first and second set of data packets.
 10. The method of claim 4further comprising transmitting an HTTP 305 Use Proxy response to theuser device.
 11. The method of claim 4 wherein the contacting theInternet Content Adoption Protocol (ICAP) server for insertion of thenotification occurs only if an HTTP 200 OK status line is included inthe second set of data packets.
 12. The method of claim 4 wherein theInternet Content Adoption Protocol (ICAP) server further requests atemplate for the notification corresponding to the IP address from anotification platform (NP).
 13. The method of claim 12 wherein thenotification platform (NP) responds with the template corresponding tothe IP address.
 14. The method of claim 13 wherein the Internet ContentAdoption Protocol (ICAP) server further inserts the notification intothe second set of data packets.
 15. The method of claim 14 wherein theInternet Content Adoption Protocol (ICAP) server further reassembles thesecond set of data packets.
 16. The method of claim 4 wherein the firstset of data packets originates from the user device.
 17. An apparatuscomprising: a processor; and a memory configured to store computerreadable instructions that, when executed by the processor, cause theprocessor to perform a method comprising: receiving a first set of datapackets marked with an indicator that indicates that an IP addressassociated with a source of the data packets should receive anotification; if the first set of data packets is HTTP traffic,transmitting the first set of data packets straight to an internetserver; if the first set of data packets is not HTTP traffic,transmitting the first set of data packets to the internet server via analternate route; receiving a second set of data packets responsive tothe first set of data packets from the internet server; contacting anInternet Content Adoption Protocol (ICAP) server for insertion of thenotification into the second set of data packets when the second set ofdata packets is HTTP traffic destined for an IP address provisioned forreceiving the notification, wherein the Internet Content AdoptionProtocol (ICAP) server parses the second set of data packets; andtransmitting the second set of data packets to a user device wherein abrowser on the user device displays the second set of data packets withthe notification on a webpage.